IndicatorPublished 30 Jan 2026Updated 31 Jan 2026

ThreatFox IOCs for 2026-01-30

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 187

utahindelevere.topSmartApeSG payload delivery domain (confidence level: 100%)
sni.ptbaconsulting.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
tannypro.comKongTuke payload delivery domain (confidence level: 100%)
trabahando.theworkpc.comMirai botnet C2 domain (confidence level: 100%)
www.ski-snowboardvancouver.caSmartApeSG payload delivery domain (confidence level: 100%)
innstantily.topSmartApeSG payload delivery domain (confidence level: 100%)
accounts.booking.ciberseguridad-eia.xyzUnknown malware botnet C2 domain (confidence level: 100%)
new-endpoints.byteconnect.ioUnknown malware botnet C2 domain (confidence level: 100%)
classicmacfiles.comUnknown Stealer payload delivery domain (confidence level: 100%)
cloudgate29.comUnknown Stealer payload delivery domain (confidence level: 100%)

URLs 32

https://cpajoliette.com/meta.google.comSmartApeSG payload delivery URL (confidence level: 100%)
https://utahindelevere.top/redirect/settings-controller.jsSmartApeSG payload delivery URL (confidence level: 100%)
https://utahindelevere.top/redirect/settings-core.phpSmartApeSG payload delivery URL (confidence level: 100%)
https://utahindelevere.top/redirect/auth-fetch.jsSmartApeSG payload delivery URL (confidence level: 100%)
http://98.142.251.59/nameSmartApeSG payload delivery URL (confidence level: 100%)
https://irforgoten.com/nameSmartApeSG payload delivery URL (confidence level: 100%)
https://98.142.251.59/methodSmartApeSG payload delivery URL (confidence level: 100%)
http://8.217.97.238:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://tannypro.com/5l8k.jsKongTuke payload delivery URL (confidence level: 100%)
https://tannypro.com/js.phpKongTuke payload delivery URL (confidence level: 100%)

IP addresses 151

213.152.162.94Nanocore RAT botnet C2 server (confidence level: 75%)
31.56.120.29Mirai botnet C2 server (confidence level: 100%)
5.175.192.109Unknown RAT botnet C2 server (confidence level: 100%)
95.168.134.12Unknown RAT botnet C2 server (confidence level: 100%)
5.175.221.21Unknown RAT botnet C2 server (confidence level: 100%)
45.194.92.39Mirai botnet C2 server (confidence level: 100%)
118.31.16.216Cobalt Strike botnet C2 server (confidence level: 100%)
45.83.31.224Remcos botnet C2 server (confidence level: 100%)
46.30.191.230Unknown RAT botnet C2 server (confidence level: 100%)
46.30.191.230Unknown RAT botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2026-01-30

Impact

For European organizations, the impact of this threat is currently moderate due to the lack of specific exploit details or active campaigns. However, the focus on network activity and payload delivery indicates potential risks to network infrastructure and endpoint security if the threat evolves or is weaponized. Organizations relying heavily on OSINT tools or those with extensive network exposure could face reconnaissance or targeted payload delivery attempts. The absence of patches or known exploits suggests that the threat is not yet actively exploited, reducing immediate risk but emphasizing the need for proactive monitoring. Potential impacts include unauthorized access, data exfiltration, or disruption of services if payload delivery is successful. The medium severity rating aligns with a scenario where the threat is emerging but not yet causing widespread damage. European critical infrastructure, financial institutions, and government agencies could be strategic targets if the threat actor leverages OSINT for precise targeting. Overall, the threat underscores the importance of integrating threat intelligence feeds like ThreatFox into security operations to detect early indicators and respond promptly.

Defensive guidance

To mitigate this threat effectively, European organizations should: 1) Integrate ThreatFox and other reputable OSINT-based threat intelligence feeds into their Security Information and Event Management (SIEM) systems to enhance detection capabilities. 2) Implement advanced network monitoring and anomaly detection tools to identify unusual payload delivery attempts or network activity patterns. 3) Conduct regular threat hunting exercises focusing on network traffic and endpoint behavior to uncover potential early-stage infections. 4) Harden network perimeter defenses, including firewalls and intrusion prevention systems, with updated rules informed by the latest IOCs. 5) Educate security teams on interpreting OSINT-derived intelligence and correlating it with internal telemetry for faster incident response. 6) Maintain up-to-date asset inventories and network segmentation to limit lateral movement if a compromise occurs. 7) Collaborate with national and European cybersecurity centers to share intelligence and receive timely alerts about emerging threats. These measures go beyond generic advice by emphasizing the operational integration of OSINT feeds and proactive network defense tailored to the nature of this threat.

Community reviews

Loading reviews…